@pushary/agent-hooks 1.9.6 → 1.9.7

package/dist/{chunk-WN6WYUCV.js → chunk-D6S5EKXA.js}

@@ -1,23 +1,23 @@
 import {
   clientErrorKindOf,
   reportClientError
-} from "./chunk-DA4FTGTK.js";
+} from "./chunk-AVNKVF7N.js";
 import {
   SubscriptionRequiredError,
   callMcpTool
-} from "./chunk-ZPW4MJOV.js";
+} from "./chunk-L76HTPU6.js";
 import {
   installNetworkDefaults
-} from "./chunk-W4Q7NFXU.js";
+} from "./chunk-JXISQ7DT.js";
 import {
   getBaseUrl
-} from "./chunk-2QRE6QH2.js";
+} from "./chunk-Z6HPS67T.js";
 import {
   ASK_AGENT_NAME_MAX,
   ASK_QUESTION_MAX,
   DECISION_LINE_MAX,
   truncateLine
-} from "./chunk-Q4E56K4X.js";
+} from "./chunk-QR6VE5ME.js";
 
 // src/api.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-6GERGJHF.js → chunk-EB4XGVBG.js}

@@ -1,10 +1,10 @@
 import {
   pusharyHookExecutable
-} from "./chunk-D7SOOVHX.js";
+} from "./chunk-4YO4T5FV.js";
 import {
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-HJXZJF6O.js";
+} from "./chunk-ZUTU43FT.js";
 
 // src/skills-cli.ts
 import { execSync } from "child_process";

package/dist/{chunk-F56SB65Y.js → chunk-GKI6LFAV.js}

@@ -3,11 +3,11 @@ import {
   decodePublicKey,
   generateSessionKey,
   wrapSessionKey
-} from "./chunk-5AXCOTIT.js";
+} from "./chunk-AUUXS44H.js";
 import {
   fetchTranscriptRecipients,
   uploadTranscriptRecords
-} from "./chunk-7JTVYR5B.js";
+} from "./chunk-4FK6RZVJ.js";
 
 // src/live-session.ts
 var MAX_TRANSCRIPT_QUEUE = 100;

package/dist/{chunk-LBLCFD5K.js → chunk-H37L7TT3.js}

@@ -1,6 +1,6 @@
 import {
   readConfigFileKey
-} from "./chunk-5BHROGRB.js";
+} from "./chunk-ADSQDYYG.js";
 
 // src/bell/fleet.ts
 import { closeSync, constants, futimesSync, lstatSync, mkdirSync, openSync, readdirSync, unlinkSync } from "fs";

package/dist/{chunk-IMGJYFCX.js → chunk-H7MMU64M.js}

@@ -8,10 +8,10 @@ import {
   codexHooksJsonIn,
   isPusharyCodexCommand,
   resolvePathBinary
-} from "./chunk-HJXZJF6O.js";
+} from "./chunk-ZUTU43FT.js";
 import {
   getPackageVersion
-} from "./chunk-Q4E56K4X.js";
+} from "./chunk-QR6VE5ME.js";
 
 // src/codex-app-server.ts
 import { existsSync, realpathSync } from "fs";
@@ -327,6 +327,7 @@ var readCodexTrustForPusharyHooks = async (options = {}) => {
 };
 
 export {
+  CODEX_HOOK_STATUS,
   assessCodexHookTrust,
   ensureCodexTrustsPusharyHooks,
   readCodexTrustForPusharyHooks

package/dist/{chunk-KK54WQ74.js → chunk-HPRZJKRO.js}

@@ -1,6 +1,6 @@
 import {
   readTranscriptPreference
-} from "./chunk-5BHROGRB.js";
+} from "./chunk-ADSQDYYG.js";
 
 // src/transcript-setting.ts
 var transcriptEnvironmentPreference = () => {

package/dist/{chunk-UKNKYTTY.js → chunk-JCWZ23MJ.js}

@@ -5,16 +5,16 @@ import {
 import {
   NOTIFICATION_MATCHED_TYPES,
   POSTTOOLUSE_MIRRORED_TOOLS
-} from "./chunk-DJ4BB264.js";
+} from "./chunk-6DJTDHBI.js";
 import {
   isProtectedByScope,
   registerHookEntry
-} from "./chunk-HJXZJF6O.js";
+} from "./chunk-ZUTU43FT.js";
 import {
   CLAUDE_PRETOOLUSE_MATCHER,
   HOOK_BUDGETS,
   HOOK_LOCATOR_BINARY
-} from "./chunk-Q4E56K4X.js";
+} from "./chunk-QR6VE5ME.js";
 
 // src/gemini-config.ts
 var GEMINI_HOOK_BINARY = "pushary-gemini-hook";

package/dist/chunk-JWKBDSPF.js

@@ -0,0 +1,69 @@
+import {
+  CODEX_HOOK_STATUS
+} from "./chunk-H7MMU64M.js";
+import {
+  NPX_LATEST_COMMAND
+} from "./chunk-STQRUH3S.js";
+
+// src/setup/codex-trust.ts
+var CODEX_TRUST_TELEMETRY = {
+  verified: "verified",
+  refused: "manual",
+  unlisted: "manual",
+  skipped: "unverified",
+  unavailable: "unverified"
+};
+var isUnanswered = (confirmation) => confirmation.kind === "skipped" || confirmation.kind === "unavailable";
+var codexTrustOutcome = (confirmation, portedTrustWritten) => isUnanswered(confirmation) && !portedTrustWritten ? "manual" : CODEX_TRUST_TELEMETRY[confirmation.kind];
+var CODEX_TRUST_REFUSED = "Codex did not accept the trust Pushary asked for, so its hooks are not trusted yet. Open Codex, run /hooks, and choose Trust for the Pushary hooks.";
+var CODEX_HOOK_REMEDY = {
+  asynchronous: "re-run setup to restore blocking permission hooks",
+  missing: "re-run setup to register the permission hooks",
+  disabled: "type /hooks in Codex to enable the permission hooks",
+  untrusted: "type /hooks in Codex and trust them, once"
+};
+var CODEX_HOOK_REPAIRS = [
+  ["asynchronous", CODEX_HOOK_STATUS.asynchronous],
+  ["missing", CODEX_HOOK_STATUS.notListed],
+  ["disabled", CODEX_HOOK_STATUS.disabled]
+];
+var eventsReporting = (readings, status) => readings.filter((reading) => reading.status === status).map((reading) => reading.event);
+var codexHookRemedy = (readings) => {
+  for (const [kind, status] of CODEX_HOOK_REPAIRS) {
+    const events = eventsReporting(readings, status);
+    if (events.length > 0) return { kind, events };
+  }
+  return { kind: "trust" };
+};
+var needsCodexTrustStep = (confirmation) => confirmation.kind !== "refused" || codexHookRemedy(confirmation.hooks).kind === "trust";
+var describeCodexHookRepair = (kind, events) => `Codex reports the Pushary hooks ${kind} (${events.join(", ")}). To fix it, ${CODEX_HOOK_REMEDY[kind]}.`;
+var describeRefusedCodexTrust = (readings, writeError) => {
+  const remedy = codexHookRemedy(readings);
+  if (remedy.kind !== "trust") return describeCodexHookRepair(remedy.kind, remedy.events);
+  return writeError ? `${CODEX_TRUST_REFUSED} Codex said: ${writeError}` : CODEX_TRUST_REFUSED;
+};
+var describeUnlistedCodexHooks = (warnings) => {
+  const said = warnings[0] ? ` Codex said: ${warnings[0]}` : "";
+  return `Codex does not list the Pushary hooks, so it will not run them.${said} Run ${NPX_LATEST_COMMAND} doctor for details.`;
+};
+var describeCodexTrustConfirmation = (confirmation) => {
+  switch (confirmation.kind) {
+    case "verified":
+      return confirmation.wrote ? "Codex trusted the Pushary hooks when asked, and confirmed it." : "Codex confirms the Pushary hooks are trusted.";
+    case "refused":
+      return describeRefusedCodexTrust(confirmation.hooks, confirmation.writeError);
+    case "unlisted":
+      return describeUnlistedCodexHooks(confirmation.warnings);
+    case "skipped":
+      return `Pushary did not ask Codex to confirm the trust: ${confirmation.reason}.`;
+    case "unavailable":
+      return `Codex could not be asked to confirm the Pushary hooks are trusted (${confirmation.reason}).`;
+  }
+};
+
+export {
+  codexTrustOutcome,
+  CODEX_HOOK_REMEDY,
+  needsCodexTrustStep,
+  describeCodexTrustConfirmation
+};

package/dist/{chunk-RDK7FX5F.js → chunk-JWQZSYCK.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-HJXZJF6O.js";
+} from "./chunk-ZUTU43FT.js";
 import {
   readJsonSafe
 } from "./chunk-T7E75EKA.js";

package/dist/{chunk-W4Q7NFXU.js → chunk-JXISQ7DT.js}

@@ -1,16 +1,16 @@
 import {
   readExistingMachineId
-} from "./chunk-3BUAEQCY.js";
+} from "./chunk-KYO45G5L.js";
 import {
   NetworkError
 } from "./chunk-7QLSKOSU.js";
 import {
   getBaseUrl
-} from "./chunk-2QRE6QH2.js";
+} from "./chunk-Z6HPS67T.js";
 import {
   clientContextHeaders,
   getPackageVersion
-} from "./chunk-Q4E56K4X.js";
+} from "./chunk-QR6VE5ME.js";
 
 // src/cli/net.ts
 import { createRequire } from "module";

package/dist/{chunk-4QKM44N6.js → chunk-KFKL3FHS.js}

@@ -1,6 +1,6 @@
 import {
   pusharyFetch
-} from "./chunk-W4Q7NFXU.js";
+} from "./chunk-JXISQ7DT.js";
 import {
   NetworkError
 } from "./chunk-7QLSKOSU.js";
@@ -9,11 +9,11 @@ import {
 } from "./chunk-KZERVKTD.js";
 import {
   getBaseUrl
-} from "./chunk-2QRE6QH2.js";
+} from "./chunk-Z6HPS67T.js";
 import {
   isValidApiKey,
   normalizeKeyScope
-} from "./chunk-Q4E56K4X.js";
+} from "./chunk-QR6VE5ME.js";
 
 // src/session.ts
 var samePusharyAccount = (left, right) => left.kind === "ok" && right.kind === "ok" && left.identity.workspaceId !== "" && left.identity.workspaceId === right.identity.workspaceId && left.identity.siteId === right.identity.siteId;

package/dist/{chunk-EVFY3VE6.js → chunk-KT5E2RLS.js}

@@ -1,7 +1,7 @@
 import {
   HOOK_HOLD_BUDGET_ENV,
   hookHoldBudgetProof
-} from "./chunk-Q4E56K4X.js";
+} from "./chunk-QR6VE5ME.js";
 
 // src/hold-budget.ts
 var takeHookHoldBudget = (args = process.argv.slice(2), env = process.env) => {

package/dist/{chunk-3BUAEQCY.js → chunk-KYO45G5L.js}

@@ -1,6 +1,6 @@
 import {
   pusharyDir
-} from "./chunk-HJXZJF6O.js";
+} from "./chunk-ZUTU43FT.js";
 import {
   writeFileAtomic
 } from "./chunk-T7E75EKA.js";

package/dist/{chunk-ZPW4MJOV.js → chunk-L76HTPU6.js}

@@ -1,12 +1,12 @@
 import {
   keyCheckFromResponse
-} from "./chunk-4QKM44N6.js";
+} from "./chunk-KFKL3FHS.js";
 import {
   installNetworkDefaults
-} from "./chunk-W4Q7NFXU.js";
+} from "./chunk-JXISQ7DT.js";
 import {
   getBaseUrl
-} from "./chunk-2QRE6QH2.js";
+} from "./chunk-Z6HPS67T.js";
 
 // src/retry.ts
 var isRetryable = (err) => {

package/dist/{chunk-SVTHEMM3.js → chunk-MBK7N46B.js}

@@ -3,27 +3,27 @@ import {
   expectedLaunchCapabilities,
   hasSpawnProvider,
   resolveControlPolicy
-} from "./chunk-MKJ3RTUS.js";
+} from "./chunk-T7Y5EADL.js";
 import {
   daemonHasRemoteProof,
   daemonServiceManagerAvailable,
   hasDaemonServiceDefinition,
   readDaemonNeedsLogin,
   readDaemonStatus
-} from "./chunk-ZC3TF4LR.js";
+} from "./chunk-VXRXFU6Q.js";
 import {
   readControlMode,
   readKeySource
-} from "./chunk-5BHROGRB.js";
+} from "./chunk-ADSQDYYG.js";
 import {
   getMachineId
-} from "./chunk-3BUAEQCY.js";
+} from "./chunk-KYO45G5L.js";
 import {
   getBaseUrl
-} from "./chunk-2QRE6QH2.js";
+} from "./chunk-Z6HPS67T.js";
 import {
   getPackageVersion
-} from "./chunk-Q4E56K4X.js";
+} from "./chunk-QR6VE5ME.js";
 
 // src/machines.ts
 import { hostname } from "os";

package/dist/{chunk-SJN22ADZ.js → chunk-MNWRUGMH.js}

@@ -1,6 +1,6 @@
 import {
   HOOK_LOCATOR_BINARY
-} from "./chunk-Q4E56K4X.js";
+} from "./chunk-QR6VE5ME.js";
 
 // src/diagnostics/bridge.ts
 import { execFileSync } from "child_process";

package/dist/{chunk-TE5M6GGK.js → chunk-MZPXVH4A.js}

@@ -3,28 +3,28 @@ import {
   addPusharyToolPermissions,
   isPusharyHook,
   removeClaudeMcpServers
-} from "./chunk-IR5FRUPQ.js";
+} from "./chunk-ANEAA37E.js";
 import {
   CLAUDE_HOOK_EVENTS,
   addGeminiMcpServer,
   removeGeminiMcpServer
-} from "./chunk-UKNKYTTY.js";
+} from "./chunk-JCWZ23MJ.js";
 import {
   CLAUDE_CODE_AGENT,
   parseApplyPatchFiles
-} from "./chunk-CCDVL63C.js";
+} from "./chunk-QFEM7R6T.js";
 import {
   guardBinary,
   holdBudgetOf,
   registerHookEntry
-} from "./chunk-HJXZJF6O.js";
+} from "./chunk-ZUTU43FT.js";
 import {
   PHONE_ANSWERED_TOOLS,
   hookCompatibleProfile,
   hookCompatibleProfileBySource,
   toToolLookup,
   withHookHoldBudget
-} from "./chunk-Q4E56K4X.js";
+} from "./chunk-QR6VE5ME.js";
 
 // src/compatible-config.ts
 import { homedir } from "os";

package/dist/{chunk-YPXUD6DW.js → chunk-N4EUSDKX.js}

@@ -14,19 +14,19 @@ import {
 } from "./chunk-U4TMAANR.js";
 import {
   callMcpTool
-} from "./chunk-ZPW4MJOV.js";
+} from "./chunk-L76HTPU6.js";
 import {
   reportedInstallSource
-} from "./chunk-75CA37FZ.js";
+} from "./chunk-4D2AYNSE.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-L6USMDTW.js";
+} from "./chunk-STQRUH3S.js";
 import {
   NO_PAIRING_COMPUTER,
   PAIR_TTL_SECONDS,
   classifyConfirmResponse,
   isAnswerSource
-} from "./chunk-Q4E56K4X.js";
+} from "./chunk-QR6VE5ME.js";
 
 // src/reach.ts
 var reachVerdict = (channels) => {

package/dist/{chunk-2I23NFVT.js → chunk-NIBFSARF.js}

@@ -1,11 +1,18 @@
 import {
   ensureCodexTrustsPusharyHooks
-} from "./chunk-IMGJYFCX.js";
+} from "./chunk-H7MMU64M.js";
+import {
+  OPENCODE_HOOK_BINARY,
+  installOpenCodePlugin,
+  openCodeHookArgv,
+  openCodePluginDir,
+  openCodeWired
+} from "./chunk-X5NXPCIC.js";
 import {
   addClaudeMcpServer,
   addPusharyHooks,
   addPusharyToolPermissions
-} from "./chunk-IR5FRUPQ.js";
+} from "./chunk-ANEAA37E.js";
 import {
   detectClaudeVersion
 } from "./chunk-RIVNNBEK.js";
@@ -15,7 +22,7 @@ import {
   codexUnprovenHolds,
   codexWired,
   geminiWired
-} from "./chunk-D7SOOVHX.js";
+} from "./chunk-4YO4T5FV.js";
 import {
   CLAUDE_HOOK_BINARY,
   CLAUDE_HOOK_EVENTS,
@@ -26,7 +33,7 @@ import {
   needsReregistration,
   registrationSignatures,
   supportedClaudeEvents
-} from "./chunk-UKNKYTTY.js";
+} from "./chunk-JCWZ23MJ.js";
 import {
   formatVersion
 } from "./chunk-6ICPEJY5.js";
@@ -49,7 +56,7 @@ import {
   registrationHolderOf,
   resolveGlobalBinary,
   vscodePluginMcp
-} from "./chunk-HJXZJF6O.js";
+} from "./chunk-ZUTU43FT.js";
 import {
   readJsonSafe,
   writeFileAtomic,
@@ -305,13 +312,24 @@ var reapplyCursorPlugin = (apiKey, paths = {}) => reapplyPluginMcp(
   apiKey
 );
 var reapplyVsCodePlugin = (apiKey, paths = {}) => reapplyPluginMcp(paths.pluginMcpPath ?? vscodePluginMcp(), apiKey);
+var reapplyOpenCodePlugin = (paths = {}) => {
+  const pluginDir = paths.pluginDir ?? openCodePluginDir();
+  if (!openCodeWired(pluginDir)) return { configured: false, reapplied: false, hooks: false, mcp: false };
+  try {
+    installOpenCodePlugin(openCodeHookArgv((paths.resolveBinary ?? resolveGlobalBinary)(OPENCODE_HOOK_BINARY)), pluginDir);
+    return { configured: true, reapplied: true, hooks: true, mcp: false };
+  } catch {
+    return { configured: true, reapplied: false, hooks: false, mcp: false, failed: true };
+  }
+};
 var reapplyAllAgents = (apiKey) => {
   const runners = [
     { id: "claude", label: "Claude Code", run: () => reapplyClaudeSettings(apiKey) },
     { id: "codex", label: "Codex", run: () => reapplyCodexSettings(apiKey) },
     { id: "gemini", label: "Gemini CLI", run: () => reapplyGeminiSettings(apiKey) },
     { id: "cursor", label: "Cursor", run: () => reapplyCursorPlugin(apiKey) },
-    { id: "vscode", label: "VS Code", run: () => reapplyVsCodePlugin(apiKey) }
+    { id: "vscode", label: "VS Code", run: () => reapplyVsCodePlugin(apiKey) },
+    { id: "opencode", label: "OpenCode", run: () => reapplyOpenCodePlugin() }
   ];
   const done = [];
   for (const runner of runners) {
@@ -336,6 +354,7 @@ export {
   reapplyGeminiSettings,
   reapplyCursorPlugin,
   reapplyVsCodePlugin,
+  reapplyOpenCodePlugin,
   reapplyAllAgents,
   ensureCodexTrustAfterReapply
 };

package/dist/{chunk-CCDVL63C.js → chunk-QFEM7R6T.js}

@@ -14,36 +14,36 @@ import {
   IDLE_PROMPT_NOTIFICATION,
   NOTIFICATION_PUSH_TYPES,
   POSTTOOLUSE_MIRROR_ONLY_TOOLS
-} from "./chunk-DJ4BB264.js";
+} from "./chunk-6DJTDHBI.js";
 import {
   cancelQuestion,
   isPolicyConfig,
   sendNotification,
   waitForAnswer
-} from "./chunk-WN6WYUCV.js";
+} from "./chunk-D6S5EKXA.js";
 import {
   clientErrorKindOf,
   reportClientError
-} from "./chunk-DA4FTGTK.js";
+} from "./chunk-AVNKVF7N.js";
 import {
   withRetry
-} from "./chunk-ZPW4MJOV.js";
+} from "./chunk-L76HTPU6.js";
 import {
   getMachineId
-} from "./chunk-3BUAEQCY.js";
+} from "./chunk-KYO45G5L.js";
 import {
   reportedInstallSource
-} from "./chunk-75CA37FZ.js";
+} from "./chunk-4D2AYNSE.js";
 import {
   canonicalJson
-} from "./chunk-HJXZJF6O.js";
+} from "./chunk-ZUTU43FT.js";
 import {
   writeFileAtomic
 } from "./chunk-T7E75EKA.js";
 import {
   getApiKey,
   getBaseUrl
-} from "./chunk-2QRE6QH2.js";
+} from "./chunk-Z6HPS67T.js";
 import {
   ACTION_BODY_MAX,
   AGENT_LABELS_BY_TYPE,
@@ -70,7 +70,7 @@ import {
   resolvePolicy,
   toToolLookup,
   truncateLine
-} from "./chunk-Q4E56K4X.js";
+} from "./chunk-QR6VE5ME.js";
 
 // src/policy.ts
 import { createHash } from "crypto";

package/dist/{chunk-5PMTC2CB.js → chunk-QQ4HBXZC.js}

@@ -1,17 +1,17 @@
 import {
   MCP_BRIDGE_BINARY
-} from "./chunk-WUKUXICK.js";
+} from "./chunk-W2KI5KPD.js";
 import {
   openCodeConfigDirFrom
-} from "./chunk-RIC6OOJX.js";
+} from "./chunk-X5NXPCIC.js";
 import {
   KEY_FILE_MODE
-} from "./chunk-5BHROGRB.js";
+} from "./chunk-ADSQDYYG.js";
 import {
   NpmMissingError,
   codexHomeFrom,
   resolvePathBinary
-} from "./chunk-HJXZJF6O.js";
+} from "./chunk-ZUTU43FT.js";
 import {
   readJsonSafe,
   writeFileAtomic,
@@ -19,10 +19,10 @@ import {
 } from "./chunk-T7E75EKA.js";
 import {
   NPX_LATEST_COMMAND
-} from "./chunk-L6USMDTW.js";
+} from "./chunk-STQRUH3S.js";
 import {
   HOOK_COMPATIBLE_PROFILES
-} from "./chunk-Q4E56K4X.js";
+} from "./chunk-QR6VE5ME.js";
 
 // src/hermes-config.ts
 import { execFileSync } from "child_process";

package/dist/{chunk-Q4E56K4X.js → chunk-QR6VE5ME.js}

@@ -697,6 +697,26 @@ var clientContextHeaders = (source) => {
   if (isClientPlatform(source.platform)) headers[CLIENT_CONTEXT_HEADERS.platform] = source.platform;
   return headers;
 };
+var AGENT_SITE_REJECTION_REASONS = [
+  "pairing_user_blank",
+  "pairing_user_mismatch",
+  "site_header_blank",
+  "device_token_blank",
+  "device_token_too_long",
+  "device_not_found",
+  "not_site_member",
+  "sandbox_site",
+  "no_current_site"
+];
+var AUTH_REJECTION_REASONS = [
+  "malformed_key",
+  "unknown_key",
+  "expired_key",
+  "scope_denied",
+  "oauth_rejected",
+  "site_not_found",
+  ...AGENT_SITE_REJECTION_REASONS
+];
 
 // ../contracts/src/index.ts
 var KEY_SCOPES = ["full_access", "agent", "connector", "bound"];